Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 31 of 677

  • 7.1 /10 High
    CVE-2026-110599 No auth

    L-SMASH - Use After Free

    L-SMASH through 2.14.5 contains a use-after-free vulnerability caused by double free in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c, letting attackers cause heap corruption and crashes by supplying crafted Annex-B streams, exploit requires crafted input stream.

  • 10.0 /10 Critical
    CVE-2026-110536 No auth

    D-Link DIR-868L - Command Injection

    D-Link DIR-868L 2.01b05 contains a command injection caused by manipulation of the SOAPACTION argument in /htdocs/cgibin HNAP CGI Handler, letting remote attackers execute OS commands remotely, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2026-110459 No auth

    UniFi Protect AI Key - Broken Access Control

    UniFi Protect AI Key contains an improper access control vulnerability, letting attackers with network access obtain information, make unauthorized changes, and cause denial of service.

  • 8.1 /10 High
    CVE-2026-110455 No auth

    UniFi Protect AI Key - Command Injection

    UniFi Protect AI Key contains a command injection caused by improper input validation, letting attackers with network access execute arbitrary commands on the device, exploit requires specific conditions.

  • 8.0 /10 High
    CVE-2026-110450 No auth

    Nix & Lix - Privilege Escalation

    Nix < 2.35.3 and Lix < 2.95.4 contain a privilege escalation caused by a repair operation that destroys and replaces a store path before content verification, letting attackers escalate privileges, exploit requires ability to trigger repair operation.

  • 7.5 /10 High
    CVE-2026-110449 No auth

    Nix & Lix - Integer Overflow

    Nix < 2.35.3 and Lix < 2.95.4 contain an integer overflow caused by mishandled list allocation when evaluating untrusted expressions, letting attackers cause out-of-bounds write, exploit requires untrusted expressions.

  • 9.2 /10 Critical
    CVE-2026-110447 CISA KEVPoC publicNo auth

    Collabora Online - Command Injection

    Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.

  • 8.8 /10 High
    CVE-2026-110445 No auth

    TeamPlus Messenger - Code Injection

    TeamPlus Messenger contains a code injection vulnerability caused by crafted content interaction, letting unauthenticated remote attackers execute arbitrary JavaScript and code with user privileges, exploit requires user interaction and confirmation of Windows security warning.

  • 8.8 /10 High
    CVE-2026-110444 No auth

    TeamPlus Messenger - Stored XSS & Remote Code Execution

    TeamPlus Messenger contains a stored XSS caused by injection of arbitrary JavaScript via crafted links, letting unauthenticated remote attackers execute code with user privileges after user confirmation.

  • 9.8 /10 Critical
    CVE-2026-110392 No auth

    Samsung Open Source QA-Board - OS Command Injection

    Samsung Open Source QA-Board contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.

  • 8.7 /10 High
    CVE-2026-110385 Auth required

    ONLYOFFICE Document Server - Remote Code Execution

    ONLYOFFICE Document Server < 10.0.0 contains a remote code execution caused by improper processing of user-controlled converter XML in Document Builder API, letting authenticated attackers with valid JWT execute arbitrary OS commands as ds service account.

  • 7.8 /10 High
    CVE-2026-110359 Auth required

    Hyland Desktop Host - Privilege Escalation

    Hyland Desktop Host for Windows < 25.1.1 contains a local privilege escalation caused by weak permissions on a privileged service in %PROGRAMDATA%\Hyland\DesktopHost\bin, letting local users escalate privileges.

  • 7.5 /10 High
    CVE-2026-110284 Auth required

    LifterLMS - Local File Inclusion

    LifterLMS WordPress plugin <= 10.3.1 contains a local file inclusion caused by improper handling of shortcode attributes in llms_get_template(), letting authenticated instructors include arbitrary files, exploit requires Instructor-level access.

  • 9.8 /10 Critical
    CVE-2026-110002 No auth

    Snazzy Social Media Feed WordPress Plugin - Unrestricted File Upload

    Snazzy Social Media Feed WordPress plugin <= 2.5 contains an arbitrary file upload vulnerability caused by missing authentication and insufficient sanitization in save-to-cache.php, letting authenticated subscribers upload executable files leading to remote code execution.

  • 8.5 /10 High
    CVE-2026-109901 Auth required

    Codepeople CP Multi View Event Calendar - SQL Injection

    Codepeople CP Multi View Event Calendar <= 1.4.41 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.